Vulnerability Note VU#377804

Multiple Open Software Foundation Distributed Computing Environment (DCE) implementations vulnerable to DoS

Overview

A denial-of-service vulnerability exists in multiple vendor implementations of the Distributed Computing Environment. This vulnerability may allow a remote attacker to cause the service to fail. Note that this vulnerability may be triggered by attackers attempting to exploit VU#568148 and VU#326746.

I. Description

The Open Group describes the Distributed Computing Environment (DCE) as an "industry-standard, vendor-neutral set of distributed computing technologies." They go on to describe DCE as follows:

DCE provides a complete Distributed Computing Environment infrastructure. It provides security services to protect and control access to data, name services that make it easy to find distributed resources, and a highly scalable model for organizing widely scattered users, services, and data. DCE runs on all major computing platforms and is designed to support distributed applications in heterogeneous hardware and software environments.

A vulnerability has been discovered in DCE which may allow a remote attacker to cause the DCE service to either hang or terminate, which will effectively make it impossible for DCE clients to communicate with the DCE server.

II. Impact

A remote attacker may be able to cause the DCE service to either hang or terminate, which will effectively make it impossible for DCE clients to communicate with the DCE server.

III. Solution

Apply a patch.

Systems Affected

Vendor	Status	Date Updated
3Com	Unknown	6-Aug-2003
Alcatel	Unknown	6-Aug-2003
Apple Computer Inc.	Not Vulnerable	7-Aug-2003
AT&T	Unknown	6-Aug-2003
Avaya	Unknown	6-Aug-2003
BSDI	Unknown	6-Aug-2003
Cisco Systems Inc.	Unknown	6-Aug-2003
Computer Associates	Unknown	6-Aug-2003
Conectiva	Unknown	6-Aug-2003
Cray Inc.	Vulnerable	6-Aug-2003
D-Link Systems	Unknown	6-Aug-2003
Data General	Unknown	6-Aug-2003
Debian	Unknown	6-Aug-2003
Engarde	Unknown	6-Aug-2003
Entegrity Solutions Corp	Vulnerable	7-Aug-2003
Extreme Networks	Unknown	6-Aug-2003
F5 Networks	Not Vulnerable	8-Aug-2003
Foundry Networks Inc.	Not Vulnerable	6-Aug-2003
FreeBSD	Unknown	6-Aug-2003
Fujitsu	Unknown	6-Aug-2003
Hewlett-Packard Company	Vulnerable	18-Aug-2003
Hitachi	Unknown	6-Aug-2003
IBM	Vulnerable	8-Aug-2003
Ingrian Networks	Not Vulnerable	8-Aug-2003
Intel	Unknown	6-Aug-2003
Juniper Networks	Not Vulnerable	8-Aug-2003
Lachman	Unknown	6-Aug-2003
Lotus Software	Not Vulnerable	11-Aug-2003
Lucent Technologies	Unknown	6-Aug-2003
MandrakeSoft	Unknown	6-Aug-2003
Microsoft Corporation	Not Vulnerable	7-Aug-2003
MontaVista Software	Unknown	6-Aug-2003
Multi-Tech Systems Inc.	Unknown	6-Aug-2003
NEC Corporation	Unknown	6-Aug-2003
NetBSD	Not Vulnerable	8-Aug-2003
Netscreen	Unknown	6-Aug-2003
Network Appliance	Unknown	6-Aug-2003
Nokia	Unknown	6-Aug-2003
Nortel Networks	Unknown	6-Aug-2003
OpenBSD	Unknown	6-Aug-2003
Openwall GNU/*/Linux	Not Vulnerable	13-Aug-2003
Oracle Corporation	Unknown	7-Aug-2003
Red Hat Inc.	Unknown	6-Aug-2003
Redback Networks Inc.	Unknown	6-Aug-2003
Riverstone Networks	Unknown	6-Aug-2003
SCO	Unknown	6-Aug-2003
Sequent	Unknown	6-Aug-2003
SGI	Unknown	6-Aug-2003
Sony Corporation	Unknown	6-Aug-2003
Sun Microsystems Inc.	Not Vulnerable	14-Aug-2003
SuSE Inc.	Unknown	6-Aug-2003
Unisys	Unknown	6-Aug-2003
Wind River Systems Inc.	Unknown	6-Aug-2003
Wirex	Unknown	6-Aug-2003
Xerox	Unknown	6-Aug-2003
ZyXEL	Unknown	6-Aug-2003

References

http://www.opengroup.org/dce/
http://www.secunia.com/advisories/9482/

Credit

This document was written by Ian A Finlay.

Other Information

Date Public	08/07/2003
Date First Published	08/08/2003 09:18:16 AM
Date Last Updated	08/18/2003
CERT Advisory
CVE Name
US-CERT Technical Alerts
Metric	22.78
Document Revision	17

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader